02.08 – TLS Certificates (Let’s Encrypt + Cloudflare)
Since I want to use MQTT on my mesh, I needed a way to expose MQTT to the outside world, but in a secure way, so this is what I came up with. I'm sure there is a much more secure way to do this, but for now, its working. Something else I needed to do was move certs from one place to another so they could be used. I generated a hook script to copy the certs automagically for me.
Install Certbot¶
Cloudflare Credentials¶
/root/.secrets/cloudflare.ini
Obtain Certificate¶
certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
-d mqtt.example.net
Cert Copy Hook¶
/etc/letsencrypt/renewal-hooks/deploy/mosquitto-copy.sh
#!/bin/bash
cp /etc/letsencrypt/live/mqtt.example.net/fullchain.pem /etc/mosquitto/certs/server.crt
cp /etc/letsencrypt/live/mqtt.example.net/privkey.pem /etc/mosquitto/certs/server.key
chown mosquitto:mosquitto /etc/mosquitto/certs/*
chmod 640 /etc/mosquitto/certs/server.key
systemctl restart mosquitto